Pin daisy below 2

CHANGELOG.md

@@ -103,6 +103,7 @@ All notable changes to cellmap-flow. The format follows [Keep a Changelog](https
 - **The Flask inference server** (`cellmap_flow/server.py`, `CellMapFlowServer`) and `CELLMAP_FLOW_ENGINE`: chunkmirage serves every model. A model's own environment (`env:`) must have chunkmirage installed, as every environment in `pixi.toml` has; a server started where it is missing fails saying so, where it fell back to the Flask server with a warning. The dashboard draws only chunkmirage layers (`zarr://<server>/<model><settings>/zarr`, channels first), so this dashboard no longer draws a server from an older cellmap-flow, nor an older dashboard this release's servers. With the server go `cellmap_flow serve --debug` (Flask's dev-server flag, which the chunkmirage server ignored), `CELLMAP_FLOW_RAW_READ_CONCURRENCY` (`CELLMAP_FLOW_RAW_CACHE_BYTES` stays), the request-cancellation plumbing in `inference.runner` (chunkmirage drops the chunks nobody waits for itself), `ImageDataInterface`'s `concurrency_limit` and `cache_bytes` arguments (the server was their only user; `io.source.open_array` keeps them) and the `flask-cors` dependency. Flask itself stays: the dashboard is a Flask app.
 
 ### Fixed
+- **daisy is pinned below 2.** daisy 2.0.0 (released 2026-10-21) is a rewrite without `daisy.tcp`, `daisy.Server` and `daisy.Client`, which blockwise uses; the pin keeps installs on the 1.2 line until blockwise is ported.
 - **A 3D model's whole network trains at the block it is served at.** *Block Size* offered 124³, 140³, 156³ and 172³ to every 3D model, and the finetune was written into the file the model was served from, whatever block it trained on: `setup_56` trained on 124³ blocks and was served at 148³. A ResUNet's InstanceNorm normalizes each block by its own statistics, so the finetune met statistics it had not learned on, and its predictions jumped across block borders. The field now offers the sides of the model's files (116³, 132³ and 148³ for the ResUNets; 124³, 140³ and 172³ for the UNets), the served one by default, and the run trains that side's file and the finetune is served from it. A *Restart* on another block is refused as a new job's.
 - **The browser's download buttons save their files.** Export Config, and the Finetune tab's volume (.zarr.zip) and finetuned model (.onnx) downloads, are download links (`<a download>`) to `/api/`, which only the page's service worker answers, and Chrome sends a download link's request to the network, past the worker: on the deployed site it failed with "File wasn't available on site", and Vite's dev server saved its own index.html. A click on one is now fetched by the page, which the worker does answer, and the reply saved under the name the backend gives it (`web/src/rebase.ts`).
 - **The browser no longer offers to save an AI-annotate key as a password.** The Finetune tab's API key and access token fields were password fields in the tab's form, so Chrome offered to save the key on a submit, with the project as the user name, though autocomplete was off; the keys are meant to be pasted each time and kept in the page only. They are now text fields shown as dots (`-webkit-text-security`), which a password manager does not offer to save, and marked for the 1Password, LastPass and Bitwarden extensions to leave alone. A browser that cannot mask a text field gets password fields back, so a key is never shown in the clear.

pyproject.toml

@@ -29,7 +29,7 @@ dependencies = [
     "neuroglancer",
     "pydantic",
     "funlib.persistence==0.6.1",
-    "daisy",
+    "daisy>=1.2.2,<2",
     "cellmap-models",
     # Below 2: tokenizers requires it, and with hub 2 allowed the resolver
     # kept hub 2 and fell back to transformers 4.12 (which bounds neither),